Gdpr Data Handling

by wshobson46891e7e60daNo licenseListed Oct 8, 2026Updated Oct 8, 2026

Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.

Instructions onlySecurity

AI-generated overview

Guides GDPR-compliant data handling: consent management, data subject rights, and privacy by design.

What it does: Provides a practical implementation guide for GDPR-compliant data processing, covering personal data categories, lawful bases for processing, and data subject rights with their response deadlines. It lists best practices for data minimization, documentation, encryption, access controls, and audits, plus practices to avoid such as pre-checked consent boxes and indefinite retention. Detailed worked examples and implementation patterns are kept in a separate reference file.
When to use it: Use when building systems that process EU personal data, implementing consent management or data subject request handling, designing privacy-first architectures, or conducting GDPR compliance reviews and creating data processing agreements.
Requirements: No scripts or tools required; instructions only. It references references/details.md for detailed implementation patterns.

GDPR Data Handling

Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.

When to Use This Skill

Building systems that process EU personal data
Implementing consent management
Handling data subject requests (DSRs)
Conducting GDPR compliance reviews
Designing privacy-first architectures
Creating data processing agreements

Core Concepts

1. Personal Data Categories

Category	Examples	Protection Level
Basic	Name, email, phone	Standard
Sensitive (Art. 9)	Health, religion, ethnicity	Explicit consent
Criminal (Art. 10)	Convictions, offenses	Official authority
Children's	Under 16 data	Parental consent

2. Legal Bases for Processing

Article 6 - Lawful Bases:├── Consent: Freely given, specific, informed├── Contract: Necessary for contract performance├── Legal Obligation: Required by law├── Vital Interests: Protecting someone's life├── Public Interest: Official functions└── Legitimate Interest: Balanced against rights

Article 6 - Lawful Bases:├── Consent: Freely given, specific, informed├── Contract: Necessary for contract performance├── Legal Obligation: Required by law├── Vital Interests: Protecting someone's life├── Public Interest: Official functions└── Legitimate Interest: Balanced against rights

3. Data Subject Rights

Right to Access (Art. 15)      ─┐Right to Rectification (Art. 16) │Right to Erasure (Art. 17)       │ Must respondRight to Restrict (Art. 18)      │ within 1 monthRight to Portability (Art. 20)   │Right to Object (Art. 21)       ─┘

Right to Access (Art. 15)      ─┐Right to Rectification (Art. 16) │Right to Erasure (Art. 17)       │ Must respondRight to Restrict (Art. 18)      │ within 1 monthRight to Portability (Art. 20)   │Right to Object (Art. 21)       ─┘

Detailed worked examples and patterns

Detailed sections (starting with ## Implementation Patterns) live in references/details.md. Read that file when the navigation summary above is insufficient.

Best Practices

Do's

Minimize data collection - Only collect what's needed
Document everything - Processing activities, legal bases
Encrypt PII - At rest and in transit
Implement access controls - Need-to-know basis
Regular audits - Verify compliance continuously

Don'ts

Don't pre-check consent boxes - Must be opt-in
Don't bundle consent - Separate purposes separately
Don't retain indefinitely - Define and enforce retention
Don't ignore DSARs - 30-day response required
Don't transfer without safeguards - SCCs or adequacy decisions

Source and attribution

Source:wshobson/agentsinplugins/hr-legal-compliance/skills/gdpr-data-handlingat commit46891e7

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Gdpr Data Handling

GDPR Data Handling

When to Use This Skill

Core Concepts

1. Personal Data Categories

2. Legal Bases for Processing

3. Data Subject Rights

Detailed worked examples and patterns

Best Practices

Do's

Don'ts

Source and attribution

More from wshobson/agents

Uv Package Manager

Web Component Design

Python Type Safety

Visual Design Foundations

Responsive Design

Python Resource Management

More in Security

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt

Secops Cases

Iam Helper For Privileged Access Management